28 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5.5	d234e36e3f	Tickets: don't adopt a Closed ticket Tinker couldn't reopen ... Tinker's create response says what it did (action). For recurrence_noted it matched a Closed ticket it could not reopen unattended: that ticket isn't tracking the alert (this is what hid micro1 enp3s0 behind an old reboot ticket), so Gandalf now logs it and keeps no ticket for the alert. Each such create adds a "recurred" comment to the closed ticket, so the same title is retried once a day rather than every poll. Other actions are logged. See tinker_tickets#116 and #115. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 01:52:53 -05:00
jaredandClaude Opus 5.5	8edaa78ad7	Revert #31: open link-down alerts from a monitor glitch were revived and ticketed ... #31 treated any open interface_down alert as previously up. Production had six such alerts all created in the same second on 2026-03-02 (a monitor glitch, on ports that were never in use: large1 enp36s0 and a USB adapter, compute-storage-01 nic1-3, micro1 enp3s0). Reviving them opened per-host tickets and a P1 cluster-wide ticket. Back to the previous behaviour while a safer fix is worked out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 01:11:00 -05:00
jaredandClaude Opus 5.5	d07787ee38	Monitor: keep checking interfaces whose link-down alert is still open ... After the interface baseline is reset, a port that is already down reads as "first seen down", which neither alerts nor resolves. An alert opened before the reset was then stuck open without updates: micro1's enp3s0 had sat at one failed check since March with no ticket. An interface with an open interface_down alert is now treated as previously up, so the alert keeps counting, tickets and resolves as normal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 01:02:53 -05:00
jared	0243b23732	Merge remote-tracking branch 'origin/main' into zimaboard-and-facing ... # Conflicts: # static/style.css # tests/test_cutsheet.py	2026-11-11 00:46:13 -05:00
jaredandClaude Opus 5.5	a9de175d90	Rack: ports-facing separate from posts, three views, ZimaBoard 832 shelves to scale ... Gear on the rear posts usually still faces the front (the StarTech's RPDU and ZimaBoard shelf), so "which posts" and "which way the ports face" are now separate fields (mount, facing). The page has three views: Front (front posts), Rear posts (rear-post gear seen from the front, i.e. what is behind the front gear) and Rear (from behind). An item seen from the side it doesn't face shows its back. Facing defaults to front, so existing items keep their meaning. Shelves are drawn at true scale with their contents ordered by a new "Position on shelf". The IceWhale ZimaBoard 832 is traced from IceWhale's labelled photo of its port end (ZimaDocs): Mini-DP, two RJ45-over-USB 3.0 stacks with link/activity LEDs, DC jack, gunmetal case, gold PCB edge and black base. Its RJ45 link lights follow the host's physical NICs and the status glow follows the host. New cutsheet_items columns facing and slot, added on first use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 00:12:07 -05:00
jaredandClaude Opus 5.5	ce12dede5f	Faceplates: USW Pro Max 24 PoE and 48 PoE ... Both laid out from the CC0 NetBox devicetype-library images, with jack centres measured from them: the 24 has one row of 24 RJ45 in groups of 8 (17-24 at 2.5G) and 2 SFP+; the 48 has two rows, odd ports on top, in groups of 16 (33-48 at 2.5G) and 4 SFP+ (49-52). The "2.5G" and "10G" bars under the faster ports are drawn too (fpSpeedBar). Registered as USPM24P/USPM48P with USPM24/USPM48 aliases, and as Front drawing options so the new switch draws on the rack before it is adopted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 00:01:12 -05:00
jaredandClaude Opus 5.5	50db56cdcb	Rack: draw the UniFi UACC blank 24-port keystone patch panel ... Front drawing "UniFi Patch Panel Blank 24" draws the real panel, laid out from the CC0 NetBox devicetype-library image: grey steel face, darker ears with oval holes, 24 keystone openings with the cable-support bar behind them, and a cable slot at each end. Ports with a documented cable get a keystone jack; cutsheet marks, port labels and run highlighting work as on the generic panel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 23:39:27 -05:00
jaredandClaude Opus 5.5	619a2c913d	Remove em and en dashes from the UI, code and docs ... Page titles read "Rack | GANDALF", ranges use a hyphen (U26-42, 1-100 of 300), empty cells show "-", and dash-separated phrases use a colon, comma or full stop. In the shared base.js only the on-screen strings changed (boot line, placeholders, offline banner and toast). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 23:37:56 -05:00
jaredandClaude Opus 5.5	0f4e129c20	Rack: drawn fronts for the NVR and server cases ... Items Gandalf has no live faceplate for can pick a Front drawing: the UniFi NVR Pro (drawn from the CC0 NetBox devicetype-library image), the Sliger CX4712 4U and Rosewill RSV-L4500U 4U cases (from driveAtlas's layouts), and generic 1U/2U/4U servers. The power light shows the linked device's live status. They export with the rest of the rack. New cutsheet_items column chassis, added on first use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 23:25:02 -05:00
jaredandClaude Opus 5.5	c50e1f8322	Rack: front and rear mounting, rack settings in the page ... Items are mounted from the front, the rear, or full depth. On a 4-post rack a front and a rear item can share a unit; a full-depth one takes both sides, and the rear view shows its back. Overlaps are checked per side. Shelf contents take the shelf's side. A Front / Rear switch flips the drawing. Racks are saved in Gandalf (new cutsheet_racks table) and edited on the rack page by admins: name, height, notes, add and delete. Renaming moves the rack's items; saving the first rack carries over the items of the config default it replaces. Config racks remain the fallback. Faceplates are stretched to the full width only when the drawing is close to the slot's proportions, so the PDU is not squashed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 22:35:37 -05:00
jaredandClaude Opus 5.5	bdd68a397d	Rack: link items to devices, shelves, several racks, export; fix layout and light mode ... Cutsheet items gain a "Gandalf device" link, so an item named after the product (UDM-Pro) shows the live device's faceplate, ports and status. Cable checks, suggestions, tickets and the device page treat an item and its linked device as one. Without this, product-named items drew as bare name plates. Items can sit on a shelf instead of a rack unit; the shelf draws what is on it with live status. Items have a rack, the page shows a tab per rack (config "racks"), and a rack can be downloaded as SVG or PNG. The rack is centred, long runs of empty units fold into one band (with a toggle), every device fills the 19" width, the UPS shows its front only, and the rack keeps its own palette so it reads in light mode. New cutsheet_items columns rack, shelf and device are added on first use. Deleting a shelf, or making it something else, is refused while it holds items; renaming it carries over. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 21:44:59 -05:00
jaredandClaude Opus 5.5	f655836446	Add a rack drawing (/rack) ... The rack front is drawn from the rack units on cutsheet items. Switches with a faceplate use it, with live port state; patch panels get a generic panel with port labels; everything else is a labelled plate. Each documented port shows its cutsheet state, and hovering a port lights up every port on the same cable run (through patch panels) and names the cables. Clicking opens the switch port or the cable. Overlapping items and items past the top of the rack are listed instead of drawn over another; where two claim the same top unit, the first one recorded wins. rack.units sets the height (default 42). /api/rack builds on the cutsheet view; cutsheet.rack_layout and cutsheet.port_marks hold the placement and per-port logic. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 20:59:30 -05:00
jaredandClaude Opus 5.5	c262e5ecc8	Inventory links, cutsheet marks on faceplates, and single page titles ... Device pages get an Inventory button: it opens the device's HomeBox record once an admin pastes its URL (stored in the new device_links table; only URLs on inventory.base_url are accepted), and searches the inventory for the model until then. Tickets link the record too. Faceplate ports with a documented cable get a corner dot: green matches, red mismatch, grey documented but unconfirmed. The port's tooltip names the cable, and a legend toggle (remembered per browser) hides them. Page titles no longer repeat GANDALF ("Alert History - GANDALF - GANDALF"). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 20:47:14 -05:00
jaredandClaude Opus 5.5	9d561db703	Add an alert history page and tie /health staleness to the poll interval ... /events lists every alert from the last 24 hours to 90 days, open or cleared, with how long each lasted, failed checks and its ticket. Filters (device, type, severity, state, range) live in the URL, so device pages and tickets link straight to a device's history. A "Recurring" table lists alerts that fired more than once on the same target. On phones the rows become cards. /api/events/history backs it (100 per page). The existing /api/events is unchanged. /health and the dashboard's monitor indicator now call the monitor stalled after five missed polls (at least 10 minutes) instead of a fixed 20, and /health reports the monitor's age. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 20:29:09 -05:00
jaredandClaude Opus 5.5	437f7a415f	Add recovery notes and fuller context to tickets ... When an alert that opened a ticket clears, the monitor now comments on the ticket (when it cleared, how long it lasted, failed checks, a link back). It never closes or changes a ticket's status. Failed notes retry each cycle for 24 hours; a 401/403 from Tinker stops them until restart. Tickets are now Markdown with a "What to check" list and, where known: the switch port the device plugs into (kept from the last time it was seen, so a dead host still shows it), cutsheet cables and their path, how often the alert fired in the last 7/30 days, other open alerts on the device, and links into Gandalf (gandalf.public_url). Titles are unchanged so Tinker's duplicate detection still works. network_events gains recovery_notified, added at monitor startup; rows that cleared before the upgrade count as already notified. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 19:44:50 -05:00
jaredandClaude Opus 5.5	86aa29b378	Cutsheet trace mode and mismatch alerts ... Trace a cord: pick a panel port, press Start, and unplug the cord at the panel. The page polls a new admin-only endpoint that reads every switch port's state from UniFi (cached 2 s), shows the one port that dropped with a button to record the cable, and confirms when it's plugged back in. Several ports dropping at once, or none within 3 minutes, is explained rather than guessed at. Mismatch alerts: the monitor runs the cutsheet check every poll. Each mismatched installed run (wrong neighbor, no link, missing port, port conflict) keeps one cable_mismatch event on its switch, resolved when fixed, and opens a P4 ticket after cutsheet.mismatch_ticket_hours (default 24, 0 never). Suppressing the switch or port stops the ticket. Also fixes buttons with the hidden attribute still showing, which left a Delete button on the new-cable form. Closes #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 16:54:57 -05:00
jaredandClaude Opus 5.5	b9412ff6ba	Add cutsheets: planned cabling checked against discovery ... A new Cutsheet page records where every cable is meant to go and compares it with what Gandalf discovers. - Inventory for what discovery can't see: patch panels, wall jacks, shelves and rack positions. Panels and jacks pass through front to rear. - Cables with two endpoints, ID, type, length, color, status (planned, installed, dark, retired) and notes; the far end may be unterminated. - Each cable's full run is traced through panels and jacks, and runs ending on a switch port are checked against its discovered neighbor (LLDP, client table, or a DAC serial seen at both ends): matches, wrong neighbor, no link, missing port, port conflict, unverified, idle. - Undocumented links: live switch ports no cable mentions, one click to add with what Gandalf already knows. Port panels show the planned cable. - Labels to make: cable IDs and panel-port labels not yet applied, with a print view, for a handheld label maker. - CSV export, and all-or-nothing import that upserts by cable ID. - Cables, panels and jacks appear in the dashboard search. Editing needs the admin group and a JSON request body. Every change is written to cutsheet_history in the same transaction. Tables are created on first use. Refs #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 16:05:08 -05:00
jaredandClaude Opus 5.5	7e588e5b02	Keep every switch port and show SFP modules ... Ports were keyed by their UniFi name, so when two ports shared a name the later one replaced the earlier. The 24-port switch lost port 13 this way (ports 13 and 14 are both "Office TV"). A repeated name is now kept as "<name> (Port N)". Traffic rates are now matched to the previous poll by port number rather than name. Names are re-read from UniFi every poll, so a port renamed there keeps its rates instead of losing them for a cycle. Collect what UniFi reports about each SFP cage: whether a module is present, its type (DAC or optic), part, serial, fault flags, and DOM readings when the module has them. The faceplate draws empty cages, optics, DACs and unidentified modules differently and outlines a faulted module in red. The port panel gets an SFP Module section. Both ends of a DAC report the same cable serial, so each end links to the other. Closes #7 Closes #8 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 14:37:08 -05:00
jaredandClaude Opus 5.5	5c4e4dc099	Only trust Authelia identity headers from the proxy ... Remote-User/Name/Email/Groups were read from every request, so a LAN host connecting to the container directly could claim any user and group. Add auth.trusted_proxies and ignore those headers unless the request came from one of them: the X-Real-IP the local nginx sets, or the peer address when gunicorn is reached directly. With nothing configured, nobody is trusted. Rejected attempts are logged, and /api/avatar now uses the same check. The container's nginx site blanks the same headers for non-NPM sources (pve-infra 4e3ab7c). Closes #3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-10 13:23:24 -05:00
jaredandClaude Opus 5.5	178a03e898	Give hosts longer before ticketing them as gone ... A host's node_exporter stops as soon as a shutdown begins and a normal reboot takes about 3-5 minutes, so the 2-check failure_threshold cut a ticket for planned reboots. Add monitor.host_failure_threshold, default 5, for hosts with no metrics and ping-only hosts. Interface link-down alerts keep the shorter threshold, and the dashboard still shows the host as down straight away. Closes #14 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 19:35:50 -05:00
jaredandClaude Opus 5.5	051e70b82b	Draw realistic front panels for every device model ... Replace the port blocks on device pages with SVG faceplates traced from reference images: Dream Machine Pro, USW Pro 24 PoE, USW Aggregation, USW Flex, USW Flex Mini, USP PDU Pro and UPS 2U Pro. Port LEDs use each model's documented colors, and ports show a cable or module when up. Remove SWITCH_LAYOUTS, which had wrong data: the aggregation switch was numbered across the rows instead of odd over even, and the USW Flex had an SFP cage it doesn't have. Models without a faceplate use plain blocks. Show PDU and UPS outlets with on/off state and auto power-cycle, and let the UPS page show its panel even though it reports no ports. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 11:11:48 -05:00
jaredandClaude Opus 5.5	bdcfb76c25	Move the port inspector onto device pages ... Replace the all-switches Inspector page with a per-device front panel, port table and detail panel. /inspector now redirects to the dashboard, and /device/<name>#port-<n> links directly to a port. Restore neighbor names after UniFi's LLDP change: read local_port_idx and resolve neighbors by MAC using Prometheus NIC data, UniFi devices and the wired client table. This also brings back Run Diagnostics on server ports, which depends on a named neighbor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 10:11:11 -05:00
jaredandClaude Opus 5.5	e32499b7f6	Add AT&T modem monitoring and device pages; replace Link Debug ... Modem and WAN: - Poll the BGW320 status pages read-only for light levels, PON and WAN state, with a WAN / Fiber panel, 7-day Rx trend, and alerts on WAN down, optical limits, and Rx drift - Read WAN outages and Smart Power restarts from the UniFi system log, since outages can be over between 5 minute polls Device pages: - Add device search to the dashboard and a page per host, switch, router, AP, PDU, or modem - Move all Link Debug data into expandable rows there; /links redirects - Collect UDM ports and UniFi device details (firmware, load, WAN, outlets) - Reorder the dashboard Monitoring fixes: - Alert when a configured host stops reporting: its series disappear rather than reporting down, so a dead host never raised an alert - Alert on Prometheus outages instead of blanking the dashboard - Treat a failed Pulse ping as unknown rather than host unreachable - Stop new switch ports reporting lifetime bytes as one interval's rate - Run database sessions in UTC: other server time zones shifted displayed ages and timed suppression expiries Also log every avatar 404 reason, add a favicon, and correct the WAN link labels (1G on Port 9, not 10G SFP+). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 23:40:17 -05:00
jared	fed279a0bd	Fix false LLDP_MISMATCH: compare the switch's name with the server's lldpd neighbour ... The switch port's LLDP entry describes the server, while the server's lldpctl describes the switch, so the two were never comparable and every link with lldpd running was flagged as cross-cabled. Pass the switch name in the port data and compare it with the server's neighbour instead; skip the check without it.	2026-10-03 02:23:26 -04:00
jaredandClaude Sonnet 4.6	0693ad56f9	Fix monitor loop double-sleep on error; add grep -F regression test ... On exception the monitor slept 30s inside the except block then fell through to time.sleep(poll_interval), giving a 150s recovery gap instead of 30s. Adding continue after the error sleep fixes this. Also adds a regression test asserting dmesg filtering uses grep -F -- so a future refactor cannot silently reintroduce the regex wildcard bug. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 13:16:43 -04:00
jaredandClaude Sonnet 4.6	e0452193ee	fix: flake8 E701 in avatar handler; update SSH test to match accept-new ... - app.py: split 'with open(sentinel): pass' onto two lines (flake8 E701) - tests/test_diagnose.py: rename test and assert StrictHostKeyChecking=accept-new (not =no which was fixed earlier) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-11 09:23:06 -04:00
jaredandClaude Sonnet 4.6	a5fcd619f8	test: expand diagnose test coverage — parsers, dmesg, lldp, and analyze ... Add 47 new tests covering parse_ethtool_driver, parse_nic_stats, parse_ethtool_dom (SFP DOM), parse_ip_link, parse_dmesg, parse_lldpctl, and the analyze() health-analysis method with all issue/warning/info code paths (NO_CARRIER, HALF_DUPLEX, SPEED_MISMATCH, SFP thresholds, CRC errors, carrier flapping, LLDP mismatch/missing). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-25 19:53:35 -04:00
jaredandClaude Sonnet 4.6	903dc960c3	Add pytest test suite and security scanning ... - Add 33 tests for DiagnosticsRunner static methods (build_ssh_command, parse_output, parse_sysfs_stats, parse_ethtool and variants) - Add test.yml CI workflow running pytest on every push/PR - Add security.yml CI workflow running bandit on every push/PR (weekly) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-14 12:22:57 -04:00